Privacy Policy

This Privacy Policy explains how Artist.FM(“Artist.FM,” “we,” “us”) collects, uses, stores, and shares information when you use our website and services (the “Service”). Artist.FM is operated by ArtistFM LLC, a limited liability company organized in New Mexico, USA. If you have questions, contact us at hello@artist.fm.

Artist.FM helps independent musicians reach playlist curators: we match you with relevant curators, help draft personalized outreach emails, send those emails from your own email account, and track the replies. Because the Service connects to your Google (Gmail) account, this policy describes in detail what Google user data we access and why.

1. Google user data and the Limited Use commitment

Artist.FM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• use Google user data for serving advertisements;
• sell Google user data, or transfer it for advertising, resale, or credit purposes;
• use Google user data to train, develop, or improve generalized or standalone AI/ML models;
• allow humans to read your Gmail data, except: (a) with your explicit prior consent for specific messages; (b) where necessary for security purposes such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized and is used to improve internal operations.

What we access, and why

When you choose to connect your account, we request the Google OAuth scopes https://www.googleapis.com/auth/gmail.send and https://www.googleapis.com/auth/gmail.readonly. We use them for exactly two purposes:

• Sending your outreach. With your instruction, we send the campaign emails (and any follow-up replies) you have reviewed, from your own Gmail account, to the curators you are contacting.
• Reading replies to your campaigns. We periodically check your inbox for replies to emails you sent through Artist.FM, so we can show you responses and their status. This check is deliberately narrow (see below).

We do not delete your email, and we do not read, index, or store mail that is unrelated to your Artist.FM campaigns.

How the reply check is scoped

To avoid reading mail we don’t need, reply detection runs in two filtered phases:

• First, we list only recent message and thread identifiers, and fetch limited headers (sender, subject, date) to identify candidates.
• We fetch the full text of a message only when it belongs to a conversation thread you started through Artist.FM, or comes from a curator you emailed through the Service. Everything else is skipped and never read in full.

The full text of a reply is used in-memory to classify it (see “AI processing” below) and is not stored. We retain only the reply’s sender, subject, a short preview snippet, the thread and message identifiers, and a short AI-generated summary and sentiment/intent label.

2. Information we collect

Account and profile information

• Your email address and account credentials, managed via our authentication provider.
• Your artist/sender name, time zone, email signature (including any social links it contains), and outreach preferences.
• The public artist identity you select (e.g. your Spotify artist profile).

Google (Gmail) data

• OAuth access and refresh tokens, so we can act on your instruction without asking you to sign in repeatedly. These are encrypted at rest(see “Security”).
• The connected Gmail address, and metadata about emails you send and replies you receive through the Service (sender, subject, snippet, thread/message IDs, timestamps, and the derived summary/sentiment described above).

Curator and contact data

The Service maintains a database of playlist curators and their public contact details (name, role, email, images, genres, social links) so you can reach out to them. When you correspond with a curator through Artist.FM, we keep a history of that interaction on your account.

Technical and log data

For security and abuse-prevention on Gmail-connected actions, we log limited technical information such as IP address, user agent, and the type of Gmail action taken, in an audit log.

3. AI processing

We use Anthropic’s Claude models, acting as our service provider, to (a) help draft and personalize your outreach emails, and (b) classify replies you receive (for example, as interested, not interested, or an unsubscribe request) and summarize them for you. To classify a reply, its text is transmitted to Anthropic for processing on our behalf under confidentiality obligations. Anthropic does not use data submitted through its API to train its models, and we do not use Google user data to train any AI/ML model. Reply text sent for classification is not stored by us beyond the metadata described above.

4. How we share information — service providers

We do not sell your personal information. We share it only with the service providers we use to run the Service, each acting on our behalf:

We may also disclose information where required by law, to protect our rights or users’ safety, or in connection with a merger, acquisition, or sale of assets (with notice as required).

5. Data retention and deletion

• Gmail access tokens are deleted when you disconnect Gmail in Settings, or when you delete your account. Disconnecting also revokes our access with Google.
• Gmail access logs (the technical audit log described above) are retained for a maximum of 90 days and then automatically purged.
• We never store the full body of your Gmail messages or the replies you receive.
• Your account data (profile, campaigns, curator interaction history, and reply metadata) is retained while your account is active, and is deleted when you delete your account.

You can delete your account and all associated data at any time from Settings → Delete account, or by emailing hello@artist.fm. Deletion is permanent and removes your profile, campaigns, interaction history, and Gmail connection.

6. Your rights and choices

You can disconnect Gmail at any time in Settings, edit your profile and preferences, and delete your account. Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of the European Economic Area and the United Kingdom have rights under the GDPR/UK GDPR; residents of California have rights under the CCPA/CPRA, including that we do not sell or “share” personal information for cross-context behavioral advertising. To exercise any right, email hello@artist.fm. You may also lodge a complaint with your local data protection authority.

7. Security

Gmail OAuth tokens are encrypted at rest using AES-256-GCM. Data is transmitted over TLS, and access to stored data is restricted at the database level. No method of transmission or storage is completely secure, but we work to protect your information and to limit what we collect and retain in the first place.

8. International data transfers

We are based in the United States and our providers may process data in the United States and other countries. Where we transfer personal data from the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. Children

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from them. If you believe a minor has provided us information, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice where appropriate.

11. Contact

ArtistFM LLC (Artist.FM), New Mexico, USA. Questions or requests: hello@artist.fm.